VMware fixes authentication bypass in Carbon Black Cloud Workload appliance

VMware has addressed a critical authentication bypass vulnerability in the VMware Carbon Black Cloud Workload appliance.

VMware has addressed a critical vulnerability, tracked as CVE-2021-21982, in the VMware Carbon Black Cloud Workload appliance that could be exploited by attackers to bypass authentication.

Carbon Black Cloud Workload is a data center security product that protects customers’ workloads running in a virtualized environment. The solution implements Endpoint Detection and Response (EDR), next-generation anti-virus (NGAV) features, and malware protection in virtualized environments.

An attacker can manipulate an URL on the administrative interface of the VMware Carbon Black Cloud Workload appliance to bypass authentication. The flaw, rated as Critical severity, was rated with a CVSSv3 base score of 9.1.

“A malicious actor with network access to the administrative interface of the VMware Carbon Black Cloud Workload appliance may be able to obtain a valid authentication token, granting access to the administration API of the appliance.” reads the advisory published by the virtualization gian. “Successful exploitation of this issue would result in the attacker being able to view and alter administrative configuration settings.”

The issue could be exploited by remote, unauthenticated attackers to obtain a valid authentication token that can be used to access the administration API of vulnerable VMware Carbon Black Cloud Workload appliances and view/modify administrative configuration settings.

Experts pointed out that that the issue doesn’t require user interaction to be exploited.

This security vulnerability affects VMware Carbon Black Cloud Workload appliance version 1.0.1 and earlier.

The flaw was privately reported to VMware by security researcher Egor Dimitrenko from Positive Technologies.

VMware states that there is no workaround for this issue and provided mitigation for customers who can’t immediately address it in their appliances.

“VMware best practices recommend implementing network controls to limit access to the local administrative interface of the appliance. Unrestricted network access to this interface is not required for the regular operation of the product.” reads the adisory.

This week the company also addressed two vulnerabilities in its vRealize Operations (vROps) product that can expose organizations to a significant risk of attacks

If you want to receive the weekly Security Affairs Newsletter for free subscribe here.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, VMware Carbon Black Cloud Workload)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.